The complete ISACA Certified Information Security Manager (CISM) study library — 12 lessons mapped to every domain and topic in the official exam guide. Free to read, no account needed.
Create a free account to track completed lessons, bookmark topics and see your exam readiness. · Pro lessons unlock with a one-time upgrade.
ISACA publishes exactly what the CISM tests and how much each part is worth. Here it is — every domain, its weight, the topics inside it, and the lessons that cover them.
Enterprise governance and the information security strategy: organizational purpose and culture, legal and regulatory requirements, roles and responsibilities, enterprise architecture, governance frameworks and strategic planning. Official weighting 18% from 3 November 2026 (17% before).
Identifying and assessing information security risk (the threat landscape, vulnerabilities and control deficiencies) and responding to it: treatment options, ownership, monitoring and reporting. Official weighting 20%.
Developing and managing the information security program: security architecture, resources, standards and frameworks, policies, asset classification, control design, implementation and testing, metrics, awareness, external parties and reporting. Official weighting 33%.
Readiness (incident response, business continuity and disaster recovery plans, the BIA, classification and testing) and operations: tools, investigation, containment, communications, eradication, recovery and post-incident review. Official weighting 29% from 3 November 2026 (30% before).
Reading every note front to back is the slowest way to pass. The exam is weighted, so your revision should be too — the blueprint above tells you exactly where the marks are.
Information Security Program carries the most marks on the CISM, so it earns the most of your attention. Work down the blueprint from the heaviest domain to the lightest rather than starting at domain 1 and grinding forward.
Read each lesson once without stopping to memorise — you are building a map, not a memory. On the second pass, read only the "what's tested" and key-takeaway blocks. If a takeaway surprises you, that lesson goes back on the pile.
Cover a lesson's key takeaways and try to say them out loud from the heading alone. Recall you can produce under your own steam is the only recall that survives a timed exam; recognition on a re-read is not the same thing.
Finishing the notes is not the goal — scoring is. Move to CISM practice questions early, then come back to the exact lessons your wrong answers point at. That loop is worth far more than a third read-through.
Exam structure, domain weights and scoring on this page come from the official CISM exam guide.